TOOLCHAIN · CVE-2026-97034 · Package
FIX → 1.27.4 +1
A malicious Go package that uses cgo can make GCC load an untrusted spec file during linking, which runs attacker-chosen commands on the build machine. The risk is at build time, when a team compiles code that pulls in a hostile cgo package.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams that build Go code with cgo on GCC, especially when they compile third-party packages that use cgo with -fopenmp, -fopenacc or -fsanitize= link flags. Pure Go builds with CGO disabled are not exposed through this path. Teams on Go 1.26.x before 1.26.11 or 1.27.x before 1.27.4 are affected.
Not affected if cgo-disabled, clang-toolchain, no-untrusted-cgo-packages
Who cares build-servers, cgo, ci, gcc, go
go version and compare against the fixed releases.CGO_ENABLED=1) with GCC and link flags containing -fopenmp, -fopenacc or -fsanitize=.go.mod.When using GCC, building a malicious package that uses cgo could cause arbitrary command execution at link time via untrusted GCC spec files ("specs" or "*.spec").
When linking with "-fopenmp", "-fopenacc", or "-fsanitize=" in "#cgo LDFLAGS", GCC's built-in link spec evaluates "%:include(libgomp.spec)" or "%:include(libsanitizer.spec)" and searches for spec files in "-L" and sysroot directories (including subdirectories and multilib sibling directories such as "../lib64"), as well as the working directory when "-fopenmp" or "-fopenacc" is used or when "-fsanitize=" is combined with "-static" or "-static-lib*".
The go command now rejects "-L", "-isysroot", and "-Wl,-syslibroot" directories (and the working and package directories when applicable) that contain GCC spec files, and disallows "@" and "-" prefixes in "-fsanitize=" compiler flag values.
Go Vulnerability Database, CC-BY 4.0. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 1.27.4 +1
1.26.111.27.4